Overview

overview

10

Static

static

8771a231ce...1e.exe

windows7_x64

10

8771a231ce...1e.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8771a231ceb9676bcfe954442c26581e
  • Size 791KB
  • Sample220301-ldmwbsheb2
  • SHA256 a8d57222d66a26a6ef7fe2d8eeb11a8af7ea9693afcbb31eece3519379c07784
  • MD5 SHA1 SHA512
Score
10/10
xloaderarh2loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • arh2

Decoy

  • anniversaryalert.com

  • kinship.space

  • buabdullagroup.com

  • ghostprotectionagency.com

  • scion-go-getter.com

  • skindeepapp.com

  • kysp3.xyz

  • bonitaspringshomesearch.com

  • bestdeals2022.online

  • themarketingstinger.com

  • chengkayouxuan.com

  • fendoremi.com

  • j-stra.com

  • klingelecn.net

  • deluxecarepro.com

  • huanbaodg.com

  • mes-dents-blanches.com

  • solutionsemissionsimplifiee.com

  • abedbashir.tech

  • good-collection.store

Targets

    • Target
      8771a231ceb9676bcfe954442c26581e
    • Size 791KB
    • SHA256 a8d57222d66a26a6ef7fe2d8eeb11a8af7ea9693afcbb31eece3519379c07784
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderarh2loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks